Accdfisa

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Accdfisa
Alias	Dacromf, Ransom.HV
Group	Police lock
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows Server
Origin
Distribution vector
UserAgent
CCProtocol
Activity	/
Status
Language
Programming language
Operation/Working group

Introduction

The specificity of this Police lock ransomware is to target various versions of Microsoft Windows server. The machines are not infected through downloading a malware but following a targeted attack and intrusion into the system, sometimes using DUBrute and a dictionary attack. ACCDFISA is the acronym for a fictitions agency: "Anti Cyber Crime Department of Federal Internet Security Agency".

In April 2012, the quoting of certain American supermarket chains on the screencopies gathered and statements published on the Web suggest that an American public is targeted.

In March 2012, France and Spain have also been specifically targetted.

Features

• Lock system

• Encrypt files

• Decryption of locked files

Associated images

• 

  ACCDFISA-variant-1-screenlocker

• 

  ACCDFISA-variant-2-screenlocker

• 

  ACCDFISA-variant-3-screenlocker

• 

  ACCDFISA-variant-4-screenlocker

Publications

	Author	Editor	Year
MoVP 1.3 Desktops, heaps, and ransomware	Michael Hale Ligh	Volatility labs	2012
The ACCDFISA malware family – Ransomware targeting Windows servers	Fabian Wosar	Emsisoft	2012
The ACCDFISA malware family – Ransomware targetting Windows servers		Emsisoft Lab	2012